CVE-2022-24521

Vulnerability Profile Updated 2 months ago
Download STIX
Preview STIX
CVE-2022-24521 is a software vulnerability discovered in 2022, characterized by a flaw in the software design or implementation. This specific vulnerability was exploited through modifications to BLF files and was one of four vulnerabilities (including CVE-2022-37969, CVE-2023-23376, and CVE-2023-28252) captured in the wild as zero-days. Zero-day vulnerabilities are software security flaws that are known to the software vendor but have no patch in place to fix them when they are exploited. The exploitation of these vulnerabilities was part of a broader trend identified in the "Windows Common Log File System Driver Elevation Of Privilege Vulnerability". Since 2018, at least thirty-two such vulnerabilities have been discovered, excluding CVE-2023-28252. Notably, three of these vulnerabilities (CVE-2022-24521, CVE-2022-37969, and CVE-2023-23376) were detected in the wild as zero-days, indicating that attackers were able to exploit these vulnerabilities before patches were available. In response to the increasing number of security bugs, Microsoft has released patches for 96 other security bugs as part of April’s Patch Tuesday, including 45 remote code execution vulnerabilities. These efforts underscore the ongoing need for vigilance and swift action in addressing software vulnerabilities, particularly those that can be exploited as zero-days.
What's your take? (Question 1 of 5)
Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.
Possible Aliases / Cluster overlaps
It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at.
IDVotesProfile Description
Miscellaneous Associations
Other elements of context that could aid in the identification of relevance
Windows
Vulnerability
Exploits
Ransomware
Kaspersky
Remote Code ...
Exploit
bugs
Associated Malware
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
No associations to display
Associated Threat Actors
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
No associations to display
Associated Vulnerabilities
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
CVE-2022-37969Unspecified
3
None
CVE-2023-23376Unspecified
3
CVE-2023-23376 is a software vulnerability, specifically an elevation-of-privilege flaw found in the Windows Common Log File System Driver. This vulnerability allows an attacker to gain system-level privileges, posing a significant risk to unpatched Windows systems. It is similar to another exploit,
CVE-2023-28252Unspecified
3
CVE-2023-28252 is a critical Elevation of Privilege vulnerability found in the Windows Common Log File System (CLFS) driver. This flaw was discovered by Kaspersky researchers while preventing attacks on users, marking it as a zero-day vulnerability. The vulnerability presents a significant risk with
FollinaUnspecified
1
Follina, also known as CVE-2022-30190, is a notable software vulnerability that was discovered and exploited in the first half of 2022. This flaw, found in the Microsoft Windows Support Diagnostic Tool (MSDT), was weaponized by TA413, a cyber threat actor group with suspected ties to China. The grou
Source Document References
Information about the CVE-2022-24521 Vulnerability was read from the documents corpus below. This display is limited to 20 results, create a free account to see more
SourceCreatedAtTitle
Securelist
a year ago
Nokoyawa ransomware attacks with Windows zero-day
Securelist
6 months ago
Windows CLFS and five exploits used by ransomware operators (Exploit #2 – September 2022)
CERT-EU
6 months ago
Ransomware Attackers Abuse Multiple Windows CLFS Driver Zero-Days | #hacking | #cybersecurity | #infosec | #comptia | #pentest | #ransomware | National Cyber Security Consulting
CISA
a year ago
#StopRansomware: Cuba Ransomware | CISA
Securelist
6 months ago
Windows CLFS and five exploits used by ransomware operators
CERT-EU
6 months ago
Windows CLFS and five exploits used by ransomware operators – GIXtools
Securelist
6 months ago
Windows CLFS and five exploits used by ransomware operators (Exploit #5 – CVE-2023-28252)
DARKReading
6 months ago
Ransomware Attackers Abuse Multiple Windows CLFS Driver Zero-Days
Securelist
6 months ago
Windows CLFS and five exploits used by ransomware operators (Exploit #4 – CVE-2023-23376)
CSO Online
a year ago
Microsoft patches vulnerability used in Nokoyawa ransomware attacks
CERT-EU
6 months ago
Windows CLFS and five exploits used by ransomware operators | #hacking | #cybersecurity | #infosec | #comptia | #pentest | #ransomware | National Cyber Security Consulting
CERT-EU
6 months ago
Carbanak Banking Malware Resurfaces with New Ransomware Tactics | #hacking | #cybersecurity | #infosec | #comptia | #pentest | #ransomware | National Cyber Security Consulting
CERT-EU
a year ago
Most Weaponized Vulnerabilities of 2022 and 5 Key Risks: Report
CERT-EU
6 months ago
Windows CLFS Driver zero-days leveraged in ransomware attacks | #hacking | #cybersecurity | #infosec | #comptia | #pentest | #ransomware | National Cyber Security Consulting
CERT-EU
6 months ago
Windows CLFS and five exploits used by ransomware operators (Exploit #2 – September 2022)
CISA
a year ago
#StopRansomware: Cuba Ransomware | CISA
Securelist
6 months ago
Windows CLFS and five exploits used by ransomware operators (Exploit #1 – CVE-2022-24521)